Skip to main content

Build a Turnkey "Deep Freeze"-Style Ubuntu System with Auto-Wiping Flash Storage

In a previous post, we discussed how to manually set up a Linux system that restores itself on every reboot, just like Faronics Deep Freeze.

Today, let's take it one step further: we'll customize an Ubuntu ISO so that:

  • It boots directly into a self-healing system,

  • It automatically sets up writable storage on a flash drive,

  • It wipes that flash drive every time you reboot.

No user intervention needed. Fully turnkey.

Prerequisites

Before we begin, you'll need:

  • ✅ A Linux system to prepare everything (Ubuntu preferred)

  • ✅ The Ubuntu 22.04 LTS ISO

  • ✅ A blank DVD or a bootable USB stick for burning

  • ✅ A second USB flash drive (at least 8GB) for temporary write space

  • ✅ Basic familiarity with the Linux terminal

Step 1: Set Up a Working Folder

First, install a few helper tools:

sudo apt update
sudo apt install squashfs-tools xorriso isolinux syslinux-utils

Now, set up a working folder:

mkdir ~/ubuntu-custom
cd ~/ubuntu-custom

Step 2: Extract the Ubuntu ISO

Download your Ubuntu ISO and extract it:

wget https://releases.ubuntu.com/22.04/ubuntu-22.04.4-desktop-amd64.iso

# Mount and copy contents
mkdir mnt
sudo mount -o loop ubuntu-22.04.4-desktop-amd64.iso mnt
rsync -a mnt/ extract-cd/
sudo umount mnt

You now have a modifiable copy of the ISO contents in extract-cd/.

Step 3: Add Our Auto-Wipe and Overlay Scripts

Inside extract-cd/, we'll embed a tiny custom startup script.

Create the directory if it doesn't exist:

mkdir -p extract-cd/casper/scripts

Now create the script:

nano extract-cd/casper/scripts/wipe-usb-overlay

Paste this:

#!/bin/bash
#
# Set up an OverlayFS using a flash drive, wiping it every boot

DEVICE=$(blkid | grep "TYPE=\"ext4\"" | grep -v "cdrom" | awk '{print $1}' | tr -d ':')  # crude but works
MOUNTPOINT=/media/usb

mkdir -p $MOUNTPOINT
mount $DEVICE $MOUNTPOINT

# Reformat USB flash drive
mkfs.ext4 -F $DEVICE

# Re-mount it fresh
mount $DEVICE $MOUNTPOINT

# Create upper and work directories for overlay
mkdir -p $MOUNTPOINT/upper
mkdir -p $MOUNTPOINT/work

# Mount overlay
mkdir -p /cow
mount -t overlay overlay -o lowerdir=/,upperdir=$MOUNTPOINT/upper,workdir=$MOUNTPOINT/work /cow

# Switch root to overlay
mount --bind /cow /

Save and close.

Make it executable:

chmod +x extract-cd/casper/scripts/wipe-usb-overlay

Step 4: Hook It Into Boot

Now, modify the boot sequence so Ubuntu will run this script automatically.

Edit extract-cd/casper/initrd by decompressing and editing:

cd extract-cd/casper
mkdir initrd
cd initrd
gzip -dc ../initrd | cpio -id

Now edit init (the master boot script):

nano init

Find a good spot after the root filesystem is mounted (you can search for mountroot) and insert:

# Custom wipe USB overlay setup
/scripts/wipe-usb-overlay

Then rebuild initrd:

find . | cpio --create --format='newc' | gzip > ../initrd
cd ..
rm -rf initrd

Step 5: Rebuild the ISO

Back in your main ubuntu-custom/ directory:

cd ~/ubuntu-custom
sudo mkisofs -D -r -V "UBUNTU_FREEZE" -cache-inodes -J -l \
  -b isolinux/isolinux.bin -c isolinux/boot.cat -no-emul-boot \
  -boot-load-size 4 -boot-info-table -o ubuntu-deepfreeze.iso extract-cd

This creates ubuntu-deepfreeze.iso — your brand-new Deep Freeze-style Ubuntu image!

Step 6: Burn and Boot

  • Burn ubuntu-deepfreeze.iso to a DVD, or

  • Flash it to a USB stick using Rufus, dd, or balenaEtcher.

When you boot:

✅ Ubuntu will load fresh
✅ It will wipe and set up the USB flash drive automatically
✅ All system changes will disappear on reboot
✅ No user input is needed

Final Notes

Area Notes
Flash Drive Wear Consider using durable, higher-end flash drives
Security Add a UUID check if you want to verify the correct flash drive
Performance Booting from USB stick (read-only) is much faster than DVD

Conclusion

Now you have a true turnkey Deep Freeze system for Ubuntu —
no more worries about malware, user errors, broken settings, or clogged hard drives.

This setup is perfect for schools, labs, libraries, pop-up installations, and experiments.

All built with 100% free and open-source tools.
Linux is magic.

Comments

Post a Comment

Popular posts from this blog

 In software engineering, accumulating code behind a release wall is akin to gathering water behind a dam. Just as a dam must be built higher and stronger to contain an increasing volume of water, the more code we delay releasing, the more resources we must allocate to prevent a catastrophic flood—major bugs or system failures—while also managing the inevitable trickles—minor issues and defects. Frequent, smaller releases act like controlled spillways, effectively managing the flow of updates and reducing the risk of overwhelming both the system and the team. The ideal of ci/cd may not be achievable for all teams, but smaller and faster is always better.
Post a Comment
Read more

Preventing accidental large deletes.

Instructions for Developers on Using the safe_delete Stored Procedure To enhance safety and auditability of delete operations within our databases, we have implemented a controlled deletion process using a stored procedure named safe_delete . This procedure relies on a temporary table ( temp_delete_table ) that lists complete records intended for deletion, not just their IDs. This approach helps prevent accidental deletions and provides a traceable audit log of delete actions. Why We Are Doing This Controlled Deletions : Centralizing delete operations through a stored procedure reduces the risk of erroneous or unauthorized deletions. Auditability : Using a temporary table to store complete records before deletion allows for an in-depth review and verification process, enhancing our ability to confirm and audit delete operations accurately. Security : Restricting direct delete permissions and channeling deletions through a specific proced...
Post a Comment
Read more

October is Cyber Security Month

The President has declared October as Cybersecurity month.  It's not a bad idea -- just like you change the batteries in your smoke detectors once a year, maybe you should review your electronic vulbnerabilities? My top ten security tips: 1) Change your passwords.  You've had them too long, you use the same password in too many places.  Somewhere someone has hacked a site that has your username and password in plain text.  Now they are getting ready to try that username/password somewhere else.  Beat them to the punch. 2) Use a safe browser.  That means anything that's not Internet Explorer.   I prefer chrome. 3) Use 2 step verification for your email account.  If your email doesn't provide 2 step authentication consider switching. 4) Get a free credit report  and review it.  You are entitled to one free report a year.   BE VERY CAREFUL!  There are man scam sites that offer free credit reports.  Go through the s...
16 comments
Read more